Focus Scroll Background

Sophos Blog

RSS

PHP advisory October 2026 feature image

Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)

BRONZE SANDCASTLE deploys modified Meterpreter shells

The China-based threat group uses DLL sideloading in these attacks

Gabor Szappanos

ConnectWise Cloud Backup application abused in cross-tenant token sweep

Automated sign-ins used the vendor's Entra application identity to request Microsoft Graph tokens across consenting tenants

Beyond the mailbox: Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion

No novelty required to be effective

shutterstock_713075854-compressor

January 10, 2020

Fake-review purge: Facebook boots 188 groups, eBay bans 140 shills

Naked Security

firefox

January 9, 2020

Browser zero day: Update your Firefox right now!

Naked Security

Naked Security Podcast

January 9, 2020

S2 Ep22: Word doc stops fraud, bye bye Python 2, latest from the ransomware swamp – Naked Security Podcast

Naked Security

shutterstock_1151944862-compressor

January 9, 2020

Apple’s scanning iCloud photos for child abuse images

Naked Security

shutterstock_1211476570 (1)

January 9, 2020

Google voice Assistant gets new privacy ‘undo’ commands

Naked Security

shutterstock_1599321841-compressor

January 9, 2020

FBI asks Apple to help it unlock iPhones of naval base shooter

Naked Security

shutterstock_1147086383-compressor

January 9, 2020

Google’s Project Zero highlights patch quality with policy tweak

Naked Security

shutterstock_611317976-compressor

January 8, 2020

REvil ransomware exploiting VPN flaws made public last April

Naked Security

shutterstock_500278447-compressor

January 8, 2020

YouTube to treat all kid-aimed videos like they’re COPPA-liable

Naked Security